Fix deployment authentication, settings publication, and Search initialization

[Paul Lizer (paullizer)]

Refs #1489

Summary

Combined deployment reliability update, based on Development b7ee5d1. Includes the Cosmos hook repair, safe postconfig settings publication, and automatic creation of missing Search indexes.

Cosmos and hook targeting

• Managed-identity mode uses the deployment runner's tenant-scoped Azure CLI Entra credential. Key mode checks disableLocalAuth before retrieving keys; stale inherited Cosmos keys never override the selected mode.
• Remove automatic Cosmos firewall mutation from both Windows and POSIX postprovision hooks. Authentication/RBAC, network and service failures are reported separately. No exemptions or authentication-policy changes are performed by the code.
• Scope Windows fallback environment lookups and POSIX role commands to the selected deployment. Non-user runners use preassigned Cosmos data roles; failures do not restart the app or report completion.

Safe postconfig and Redis

• Consolidate the two Redis configuration blocks introduced by the earlier work. Preserve operator-configured external Redis when no cache host is deployed.
• Use the application AppSettingsStore for ETag-checked writes and fenced Redis publication. Merge intended changes into authoritative settings, preserving concurrent unrelated edits.
• Verify stored values after publication. Refuse actual active-cache endpoint/auth migrations; allow equivalent service/port normalization.
• Reuse the application's Redis connection semantics with the deployment CLI credential. An enabled Redis cache requires the runner to have Redis data access and network connectivity; Azure resource Owner alone is not sufficient. Publication failure is not reported as a successful save.

Search initialization

• Create missing user/group/public indexes from the same JSON schemas used by the admin UI.
• Leave existing indexes, schemas and documents untouched. Only not-found triggers creation; permission/service errors fail and concurrent creation is verified by reading the index.

Validation

• 184 focused deployment, settings-store, cache, credential-redaction and compatibility tests passed.
• Offline executable Windows and POSIX hook tests, including explicit environment selection and failure-before-restart behavior.
• Full postconfig entrypoint exercised with fake services and the real shared settings store.
• PowerShell and POSIX hook syntax checks passed.
• Broken-access-control and XSS guardrails passed for the changed deployer code; diff whitespace check passed.
• Documentation site quality: 6/6 checks passed.
• Documentation surface coverage: 6/7 passed. The generated inventory is stale on unmodified Development too, verified against an archive of the branch baseline; unrelated inventory changes were not included.
• Existing tests emit 18 return-value warnings. The existing editor YAML warning about dockerfile predates this change.

Operational notes

• No live Azure resources were changed while implementing or testing this PR. Cloud deployment of this new hook implementation remains to be validated with an appropriately authorized runner.
• Existing public/private network policy must permit the runner. No automatic IP allowlisting, key-auth fallback, or policy exemption creation occurs.
• Redis-enabled postconfig requires a suitable Redis database access policy (for example Data Owner) for the runner. Search creation requires Search Service Contributor access. Non-user runners need a preassigned Cosmos data role.
• AZURE_ENV_NAME and AZURE_TENANT_ID are required. Rerun postprovision after correcting access; the hook restarts the service only after configuration succeeds.
• Active Redis migrations and existing Search schema upgrades remain administrator-managed operations.

Versions: application 0.261.028; deployer 1.0.31. Existing deployment reference and fix documentation updated. No environment files, tenant-specific waivers, or credentials are included.

Release Notes Follow-Up

Release notes for v0.261.028 now cover the Cosmos hook changes, safe settings publication, missing Search index creation, and runner access requirements. Issue #1489 tracks review and pending Azure validation; related Cosmos container-lifecycle issues remain separate.